CVE-2026-33510

HighPublic PoC

Published: 06 April 2026

Published

06 April 2026

Modified

09 April 2026

KEV Added

—

Patch

—

CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L

EPSS Score 0.0005 16.4th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-33510 is a high-severity Improper Neutralization of Alternate XSS Syntax (CWE-87) vulnerability in Homarr Homarr. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 16.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

Requires validation and sanitization of the untrusted callbackUrl parameter to prevent injection of malicious JavaScript payloads leading to DOM-based XSS.

SI-15 Information Output Filtering good match

prevent

Mandates filtering of output prior to client-side processing in redirect and router.push functions to neutralize XSS payloads.

SI-2 Flaw Remediation good match

prevent

Ensures timely remediation of the specific flaw through patching to version 1.57.0 or later, eliminating the vulnerability.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1059.007 JavaScript Execution

Adversaries may abuse various implementations of JavaScript for execution.

attack.mitre.org →

Why these techniques?

DOM-based XSS in public-facing Homarr login page directly enables exploitation of the exposed web app (T1190) and arbitrary JavaScript execution in the victim's browser via the unsanitized callbackUrl parameter (T1059.007).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Homarr is an open-source dashboard. Prior to 1.57.0, a DOM-based Cross-Site Scripting (XSS) vulnerability has been discovered in Homarr's /auth/login page. The application improperly trusts a URL parameter (callbackUrl), which is passed to redirect and router.push. An attacker can craft…

a malicious link that, when opened by an authenticated user, performs a client-side redirect and executes arbitrary JavaScript in the context of their browser. This could lead to credential theft, internal network pivoting, and unauthorized actions performed on behalf of the victim. This vulnerability is fixed in 1.57.0.

Deeper analysisAI

CVE-2026-33510 is a DOM-based Cross-Site Scripting (XSS) vulnerability affecting Homarr, an open-source dashboard, in versions prior to 1.57.0. The issue resides in the /auth/login page, where the application improperly trusts the callbackUrl URL parameter and passes it directly to redirect and router.push functions without proper sanitization. This flaw is associated with CWE-87 (Improper Neutralization of Special Elements used in an XSS Attack) and CWE-601 (URL Redirection to Untrusted Site ('Open Redirect')).

An unauthenticated attacker (PR:N) can exploit this vulnerability over the network (AV:N) with low complexity (AC:L) by crafting a malicious link containing a payload in the callbackUrl parameter. The attack requires user interaction (UI:R), such as an authenticated victim clicking or opening the link, which triggers a client-side redirect and executes arbitrary JavaScript in the victim's browser context with changed scope (S:C). Successful exploitation can result in high confidentiality impact (C:H), such as credential theft, along with low integrity (I:L) and availability (A:L) impacts, including internal network pivoting and unauthorized actions on the victim's behalf. The CVSS v3.1 base score is 8.8.

The vulnerability has been fixed in Homarr version 1.57.0. Security practitioners should upgrade to this version or later. Additional details are available in the GitHub security advisory at https://github.com/homarr-labs/homarr/security/advisories/GHSA-79pg-554g-rw82.